Legal and Ethical
Data Protection
Contents
Processing personal data means doing anything with it: any action taken with information that can identify a living person. The person the data is about is called the data subject.
Processing covers a whole chain of actions, including:
- collecting it, such as asking for details on a sign-up form
- storing it, whether on paper, on a computer or in the cloud
- using it, for example looking up a customer's order
- sharing it with another organisation
- deleting it once it is no longer needed
Even small actions count. Opening a record, correcting a phone number or printing a list are all ways of processing personal data.
The law applies to organisations
In the UK, the Data Protection Act 2018 and UK GDPR work together as the current law. Any organisation that processes personal data, from a corner shop to a secondary school, must follow the data protection principles. These include processing data lawfully, collecting it only for the stated purpose, collecting only what is needed, keeping it accurate, keeping it only as long as necessary and protecting it.
The principles are legal requirements, not optional good practice. An organisation that ignores them can be investigated by the Information Commissioner's Office (ICO) and fined. For example, a youth football club collects players' names and medical conditions on registration forms, keeps them in a spreadsheet, uses them to contact parents about matches and deletes them when a player leaves. Each of those steps is processing, so each must follow the principles, such as asking only for the information the club genuinely needs.
Where the data is stored does not matter
The law follows the data wherever it is held: on a shop till, on a staff laptop, in paper files or in cloud storage, even when the cloud service runs on servers in another country. Moving data into the cloud does not pass responsibility to the cloud provider. The organisation that collected the data stays responsible for looking after it, so it should check how securely the provider stores and protects it.
Data protection principles are legal rules organisations must follow when processing personal data. In the UK they come from the UK GDPR and the Data Protection Act 2018.
The seven principles
| Principle | What it requires | What breaks it |
|---|---|---|
| Lawful processing | Have a valid lawful basis, obey other laws, use data fairly and openly, and never in unduly harmful, unexpected or misleading ways. | A company collects details with no lawful basis and hides what it really uses them for. |
| Purpose limitation | Be clear from the start why data is needed, record those purposes and tell people. A new purpose needs compatibility, consent or a clear legal obligation. | A library takes an address to post a replacement card, then uses it to send fundraising letters without consent. |
| Data minimisation | Collect only data that is adequate, relevant and necessary. | A free coding club asks for your home address and a parent's salary, which it does not need. |
| Accuracy | Take reasonable steps to keep data correct and not misleading, update it, fix or erase inaccurate data quickly and consider challenges carefully. | A swimming club is told an emergency contact changed but keeps the old number. |
| Storage limitation | Keep data no longer than necessary, justify retention in policy, then review and erase or anonymise it. Data subjects can challenge retention and ask for erasure when data is no longer needed. | A repair shop plans to keep every customer's address for 50 years "just in case". |
| Protected | Use appropriate security measures. | A tutoring company leaves student records in a shared folder any staff member can open. |
| International transfers | Do not transfer data to countries with less protection. | A shop moves customer records to a server in a country with weaker protection and no safeguards. |
Anonymising data removes identifying details so it is no longer personal data. A bus company, for example, can turn its journey records into anonymous counts of passengers at each stop, and then use those counts freely.
Data subject rights are the legal rights of the person a record is about, called the data subject. An organisation must respect these rights as part of data protection; they are not optional good practice.
Subject access means you can ask to see all the personal data an organisation holds about you and get copies. For example, a youth theatre group must show a member the contact details and attendance notes it keeps about them. If an organisation refuses to let someone see or obtain copies of their data, it breaks their subject access rights.
The right to be informed means you must be told how your data is used, including whether it is shared or sold. A puzzle app that passes your username to an advertising company should explain this clearly.
Consent is your permission for how your data is used. You also have the right to object to processing, such as asking a music streaming service to stop using your listening history to choose adverts for you.
The right to be forgotten lets you ask an organisation to delete all your personal data. The organisation must act if it has no further use for the data, or if you object to it being used for marketing. This is a right you must request; it is not automatic.
Breach notification means you have the right to be told if there is a breach of your data that is likely to put you at risk. If a climbing centre loses a tablet holding members' emergency contact details, it must tell the people affected when the loss is likely to put them at risk.
When you email more than one person, your email program gives you three address boxes: To, Cc and Bcc. Addresses typed into To or Cc appear in the header that every recipient receives. An address typed into Bcc (blind carbon copy) is hidden from the other recipients.
What each recipient can see
| Box used | Visible to the other recipients? |
|---|---|
| To | Yes, everyone sees it |
| Cc | Yes, everyone sees it |
| Bcc | No, it is hidden |
So the To and Cc lists are visible to all, the Bcc list is visible only to the sender, and the people in Bcc cannot see each other. If a recipient replies to everyone, only the To and Cc addresses are contacted.
Why this protects personal data
An email address identifies a living person, so it is personal data. Imagine you are collecting raffle prizes for a school charity fair and you email 15 local shops to ask. If every address goes in To, each shop opens a message listing the other 14 and learns who else you asked; some owners may not want a rival to know they are helping.
Putting the 15 addresses in Bcc means each shop sees only its own address and yours, so no address reaches anyone with no reason to hold it. That applies the protected principle: personal data is kept secure and seen only by the people who need it. As a rule, use Bcc for a group who do not know each other, and To when everyone may need to reply to all.
Bcc hides addresses, not the message: everyone still receives the same email and can forward it, so it does not keep the contents secret. It also works for a single hidden address. A student emailing a leisure centre about a cancelled swimming lesson can Bcc a parent, so the parent gets a copy while the centre never collects the parent's address.